I gave an AI the complete source code and asked it to check for risk.
Before asking anyone to trust this extension, I wanted an honest, independent second opinion on my own code — not written by me, not filtered by me. So I opened a brand-new chat, with no prior conversation, uploaded every single file that makes up WaitEarn (extension code, backend Cloud Functions, Firestore security rules — no exceptions), and asked directly: is there anything here that could put a user at risk?
Why Claude? I used Claude (Anthropic's AI), which is widely regarded as one of the strongest AI models for reading and reasoning about code. I gave it every file that makes up this project directly in the chat and asked it to analyze the whole thing with no restrictions.
Why not just share the code publicly? I considered publishing a public link to the full codebase so anyone could verify it themselves. But sharing that link openly would have exposed the raw source — including backend logic — to anyone on the internet, not just people trying to verify safety. Instead, what follows is the real chat: the files and prompt I gave Claude, and its full, unedited response, screenshotted directly from that conversation.
This was a first message in a brand-new conversation — no earlier context, no prior back-and-forth shaping the answer beforehand.
The conversation, as it happened
Below are screenshots of the actual chat — my prompt, followed by the AI's complete analysis, unedited.
Full-screen captures of the review conversation, shown exactly as it happened.
What Claude's review found
- 1 No AI conversation access. The extension only detects when an AI is generating a response (via UI indicators like a "Stop" button), and never reads the actual prompt or response text. No keylogging, clipboard access, or content harvesting was found.
- 2 Data collected is limited and purpose-matched. Email, account ID, a device fingerprint (to prevent multi-accounting), earnings totals, and ad interaction events. Interaction timestamps are also recorded — not content — to prevent reward farming. Nothing beyond this scope was found.
- 3 Permissions are appropriately scoped. No broad "access all websites" permission — access is limited to the named AI chat sites plus required Google/Firebase endpoints. One noted trust dependency: the WaitEarn website has a privileged channel to log users in/out of the extension directly.
- 4 Reward system is properly secured. The client never self-credits its own balance — a server-side Cloud Function performs the actual balance writes, fraud checks, and rate-limiting. Client-side checks are explicitly "soft" pre-filters only, not the real enforcement.
- 5 Overall verdict: low-to-moderate risk, reasonably trustworthy. A solid architecture that separates "polite" client-side checks from real server-side enforcement, minimal permissions, and no evidence of hidden data collection. The disclosed items — session token storage, device fingerprinting, and the website's login privileges — are all consistent with the extension's stated functionality, not deceptive.
This is Claude's own written verdict from the review, reproduced here without edits. This page will be updated any time meaningful changes are made to the code, so it always reflects what's actually running.